6bda293dbe4e89179edbf891de88f346a9fbe82b7e80617dce5eb36c10900ec6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-xtfmqsthnd
SHA256 6bda293dbe4e89179edbf891de88f346a9fbe82b7e80617dce5eb36c10900ec6
MD5 e003431798d2b33f1545ae57c5336279
SHA1 ca4dbcd553f2b58ce0eefe6bb47a8cbcec60bb72
SHA512 61107e1cc173adee62655203e73bf366ef45a3319cd163c5ccd372a6de9f1e840a78643bef242682782aece7fc0a059eced8df94e45d31c93cdc8260bab1282b
SSDEEP 49152:Qoa1taC070dSoNz/Fq0OCqdQ4aFjzPanJ8mUme6:Qoa1taC0yNz/39qd4FvanJ8vme6
TLSH
T1A6952350FBC4C2B2C0850631B592C7E6D8693E7C96469C837FCC1B3F29A4ED4A662B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2412	8BEA.tmp

Executes dropped EXE 1 IoCs

pid	Process
2412	8BEA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8BEA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 2412	5320	2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\8BEA.tmp
  "C:\Users\Admin\AppData\Local\Temp\8BEA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_e003431798d2b33f1545ae57c5336279_amadey_elex_smoke-loader.exe F2ED108AC86C1BDD96534E17230F8456E370EE0C85F081F7B5AE491D79DBE91A5E73CFA566A385CFD15765AD8CA5605A1D0451B67E6347296932BC552CAAA2F3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8BEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\8BEA.tmp
Size 1.9MB
SHA256 383c915978f2bc769f43defc8fd09a2483a19a30811e8369a6e0a6d70af83cd1
MD5 1d231255b173c16fa4f3dd86fe668eb8
SHA1 136c7c5f8b5599d20f5996db8b9dc3643af818cf
SHA512 a6161525d32d79e321030047b07599e733be7b7925536194d46473fc9b574465d5f8dac0eadc277421d9d359f3f6e79b9900f37a8c4e94f445514e3259e2fa20
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dGYJnK+rBRT1WMdIyqgMEkZkMb5ZISIkBjgu5:Qoa1taC070dpR1CgMVG6B81yb
TLSH
T185952360F6D1C2B2D0C106719992C3E7E86A3D7896869D83BFC81A3F2C94FC4A635757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2412-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5320-0-0x0000000000400000-0x00000000005E6000-memory.dmp